Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
-
submitted
29/06/2024, 14:04
General
-
Target
ae99906d31e01eb7101a175b706cea87a00e62ee7547f916080c9efafc48d958_NeikiAnalytics.exe
-
Size
135KB
-
MD5
14169dd9c539e2ea4b115e5009028830
-
SHA1
fbb10e26b81c90c7816ba68c55fba22f06a593d4
-
SHA256
ae99906d31e01eb7101a175b706cea87a00e62ee7547f916080c9efafc48d958
-
SHA512
c0d9dd58ec7004b784ba28df05e6cc4930694d5176c5c1ba17e44114dbf5c5b46b8d299223a844cc235eb5e968d77cb2232b3d3e7a777fc02fa86544ad1225e6
-
SSDEEP
1536:UfsEqouTRcG/Mzvgf7xEuvnXNTRdUzwTekUOisZ1yDDajtXbVXr:UVqoCl/YgjxEufVU0TbTyDDalRr
Malware Config
Signatures
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
-
Executes dropped EXE 4 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Drops file in System32 directory 2 IoCs
-
Drops file in Windows directory 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae99906d31e01eb7101a175b706cea87a00e62ee7547f916080c9efafc48d958_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ae99906d31e01eb7101a175b706cea87a00e62ee7547f916080c9efafc48d958_NeikiAnalytics.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\themes\explorer.exec:\windows\resources\themes\explorer.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe SE3⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\svchost.exec:\windows\resources\svchost.exe4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\resources\spoolsv.exec:\windows\resources\spoolsv.exe PR5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135KB
MD5d544373912200fe653f8f887cd2dbdfc
SHA19480863068a64b6e0ac4bf31d7f519976b78a739
SHA256cf7103e635d8180f0c93843ca765db87e6106b5138ea0a985be33da5e738415d
SHA51226146808118c0097fdc8e5f7a54c1f0bca9e31e49049a36401e670108c1059d86c01797005627b9119d1b7064327c77b3bb9fe4040e0c1e9df92baecc16db030
-
Filesize
135KB
MD520be4cd5035845ac8d79f5d3a35617be
SHA130cf272b923ae0d4ea03b15a50229a89578e44b4
SHA256ec2cf6a9a6922a3a096bdbf435940c7ddd762558d937c72e1e58fcb7f2219e8d
SHA512ffb4f594d771b6209913ed658d3b8a737fd7b9872d649dab25297ddfe6d6b9492c42cb914bb2c7df1f6d30d4314663761278e836e79d3bbb9acb86c02bd37df7
-
Filesize
135KB
MD582a6486ddbd1dadd273f92529ce26a37
SHA112a254aa72f947e389402222ecda979ea15a7262
SHA25642749bd32ec3c7701fce400b1ad7f07dbdb6ffab9f4ab209b766c58970a87867
SHA5125b921e92d08e8a4d1c7500a75f3fe6a63cd581ccbf6acf1a13b2966bf2821036dd397f811915852ec8465df4301516c28d038258713604eccc3b0b6476c9e554
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB
-
Filesize
124KB